Chainalysis, the firm police use to trace crypto crime, says an attacker using 'offensive agentic techniques' got into its systems

Chainalysis sells blockchain analysis tools that police, tax authorities and crypto exchanges use to follow stolen and illicit money. On 30 October 2026 it published a security notice that put a new phrase into a breach disclosure: the attacker used "offensive agentic techniques".

What happened

In the company's words, it "detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools" this month. It says its teams have been working around the clock to investigate, patch vulnerabilities and harden its systems, and it has notified all of its customers.

Agentic usually means AI systems that carry out multi-step tasks with little human input. Chainalysis didn't name an AI model, describe how the attack unfolded, identify the attacker or say how they got in. So the notice supports the claim that agentic techniques were used, but not that an AI ran the whole break-in by itself.

What was taken

Chainalysis says some customer data it calls non-sensitive was accessed: user IDs, full names, email addresses and organisation role labels for users set up on its platform. Based on the evidence so far, it says there's no sign the attacker reached investigation content such as graphs, notes or cases, transaction or query results, clear-text passwords, MFA secrets or session tokens.

It hasn't said how many users or organisations are affected. It says it is still working out which records were accessed for each customer organisation and will send each one a breakdown.

What Chainalysis said

The company stresses that the incident is not related to the recent crypto theft at Binance, which it is helping to trace. It has brought in outside security experts and says it is using large language models to support a wider review of its platform's security, beyond the holes that were exploited. It tells users to watch out for unexpected password reset requests or login prompts, and to turn on two-factor authentication if they haven't.

Our take

This is our opinion. Names, work emails and job roles for the people who investigate crypto crime are exactly what a convincing phishing email needs, so "non-sensitive" is doing a lot of work here. And when attackers bring agents, the boring defences matter more: patch fast, put internal tools behind strong login, and watch for odd automated access patterns, not just odd people.